Code review fixes: wardrobe migration, response validation, path traversal guard, deduplication

- Migrate 11 character JSONs from old wardrobe keys to _BODY_GROUP_KEYS format
- Add is_favourite/is_nsfw columns to Preset model
- Add HTTP response validation and timeouts to ComfyUI client
- Add path traversal protection on replace cover route
- Deduplicate services/mcp.py (4 functions → 2 generic + 2 wrappers)
- Extract apply_library_filters() and clean_html_text() shared helpers
- Add named constants for 17 ComfyUI workflow node IDs
- Fix bare except clauses in services/llm.py
- Fix tags schema in ensure_default_outfit() (list → dict)
- Convert f-string logging to lazy % formatting
- Add 5-minute polling timeout to frontend waitForJob()
- Improve migration error handling (non-duplicate errors log at WARNING)
- Update CLAUDE.md to reflect all changes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

data/characters/2b.json

@@ -16,14 +16,13 @@
     "scene": ""
   },
   "wardrobe": {
-    "full_body": "black_dress, lace-trimmed_dress, gothic_lolita",
-    "headwear": "blindfold",
-    "top": "black_dress, cleavage_cutout, feather_trim",
-    "bottom": "short_dress",
-    "legwear": "thighhighs",
-    "footwear": "thigh_boots, black_boots, high_heels",
-    "hands": "black_gloves",
-    "accessories": "katana, sword_on_back"
+    "base": "black_dress, lace-trimmed_dress, gothic_lolita",
+    "head": "blindfold",
+    "upper_body": "black_dress, cleavage_cutout, feather_trim",
+    "lower_body": "short_dress",
+    "additional": "katana, sword_on_back",
+    "feet": "thighhighs, thigh_boots, black_boots, high_heels",
+    "hands": "black_gloves"
   },
   "styles": {
     "aesthetic": "gothic_lolita, science_fiction, dark_atmosphere",